Lockstep Mcp

io.github.mrfentmenPublished by GitHub account mrfentmenv1.0.0Updated Nov 5, 2026

Local lockfile and package-manager reproducibility analysis without dependency details. Tools...

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that inspects lockfiles and package-manager signals to flag reproducibility drift in small projects, without exposing dependency details.

What you can do
  • Inspect lockfile presence and package-manager signals in a project directory
  • Count lockfile bytes and lines and detect structural lockfile markers
  • Flag a package manifest that has no matching lockfile
  • Report results without returning dependency names, versions, lockfile contents, or environment values
When to use it
Useful when you want a quick, privacy-preserving check of whether a small project's lockfile setup looks consistent, for example before handing a repo to someone else or when diagnosing why installs differ between machines. It is a reproducibility aid, not a vulnerability scanner or build oracle.
Requirements
Runs as a local process over stdio, installed from the npm package @mrfentmen/lockstep-mcp, so Node.js is needed. Access is bounded by the LOCKSTEP_ROOT environment variable, which sets the root path it may inspect. No accounts, API keys, or network access are declared.
Before you install
It reads local project files, so point LOCKSTEP_ROOT at the intended directory only; paths are restricted by that root and realpath checks. It skips Git data, dependencies, build output, coverage, and caches, and is designed not to return dependency names, versions, lockfile contents, or environment values. It does not assess vulnerabilities or guarantee build outcomes.

Installation

In SourceWeft

  1. Open Lockstep Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

lockstep-mcp

Lockstep is a local MCP tool for spotting reproducibility drift in small projects. It identifies package-manager lockfiles, counts their bytes and lines, detects structural lockfile markers, and flags a package manifest with no matching lockfile.

Tool

  • inspect_reproducibility: inspect lockfile presence and package-manager signals without returning dependency names or versions.

Safety

  • Local paths only, bounded by LOCKSTEP_ROOT and realpath checks.
  • Skips Git data, dependencies, build output, coverage, and caches.
  • Never returns dependency names, versions, lockfile contents, or environment values.
  • Caps recursion, file count, file size, and output.
  • This is a reproducibility aid, not a dependency vulnerability scanner or build oracle.

Source: README.md at commit f2b8fa5

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestSep 22, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.